Add PKCS#8 utility functions and add PBE options. (525f51f6) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -4,6 +4,12 @@

	Changes between 0.9.4 and 0.9.5 [xx XXX 1999]		Changes between 0.9.4 and 0.9.5 [xx XXX 1999]

			*) Add a bunch of DER and PEM functions to handle PKCS#8 format private
			keys. Add some short names for PKCS#8 PBE algorithms and allow them
			to be specified on the command line for the pkcs8 and pkcs12 utilities.
			Update documentation.
			[Steve Henson]

	*) Support for ASN1 "NULL" type. This could be handled before by using		*) Support for ASN1 "NULL" type. This could be handled before by using
	ASN1_TYPE but there wasn't any function that would try to read a NULL		ASN1_TYPE but there wasn't any function that would try to read a NULL
	and produce an error if it couldn't. For compatibility we also have		and produce an error if it couldn't. For compatibility we also have

apps/pkcs12.c

+25 −3

Original line number	Original line	Diff line number	Diff line
	@@ -104,6 +104,7 @@ int MAIN(int argc, char **argv)
	int twopass = 0;		int twopass = 0;
	int keytype = 0;		int keytype = 0;
	int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;		int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
			int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
	int ret = 1;		int ret = 1;
	int macver = 1;		int macver = 1;
	int noprompt = 0;		int noprompt = 0;
	@@ -143,7 +144,27 @@ int MAIN(int argc, char **argv)
	else if (!strcmp (*args, "-maciter"))		else if (!strcmp (*args, "-maciter"))
	maciter = PKCS12_DEFAULT_ITER;		maciter = PKCS12_DEFAULT_ITER;
	else if (!strcmp (*args, "-nodes")) enc=NULL;		else if (!strcmp (*args, "-nodes")) enc=NULL;
	else if (!strcmp (*args, "-inkey")) {		else if (!strcmp (*args, "-certpbe")) {
			if (args[1]) {
			args++;
			cert_pbe=OBJ_txt2nid(*args);
			if(cert_pbe == NID_undef) {
			BIO_printf(bio_err,
			"Unknown PBE algorithm %s\n", *args);
			badarg = 1;
			}
			} else badarg = 1;
			} else if (!strcmp (*args, "-keypbe")) {
			if (args[1]) {
			args++;
			key_pbe=OBJ_txt2nid(*args);
			if(key_pbe == NID_undef) {
			BIO_printf(bio_err,
			"Unknown PBE algorithm %s\n", *args);
			badarg = 1;
			}
			} else badarg = 1;
			} else if (!strcmp (*args, "-inkey")) {
	if (args[1]) {		if (args[1]) {
	args++;		args++;
	keyname = *args;		keyname = *args;
	@@ -224,6 +245,8 @@ int MAIN(int argc, char **argv)
	BIO_printf (bio_err, "-maciter use MAC iteration\n");		BIO_printf (bio_err, "-maciter use MAC iteration\n");
	BIO_printf (bio_err, "-twopass separate MAC, encryption passwords\n");		BIO_printf (bio_err, "-twopass separate MAC, encryption passwords\n");
	BIO_printf (bio_err, "-descert encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");		BIO_printf (bio_err, "-descert encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
			BIO_printf (bio_err, "-certpbe alg specify certificate PBE algorithm (default RC2-40)\n");
			BIO_printf (bio_err, "-keypbe alg specify private key PBE algorithm (default 3DES)\n");
	BIO_printf (bio_err, "-keyex set MS key exchange type\n");		BIO_printf (bio_err, "-keyex set MS key exchange type\n");
	BIO_printf (bio_err, "-keysig set MS key signature type\n");		BIO_printf (bio_err, "-keysig set MS key signature type\n");
	BIO_printf (bio_err, "-password p set import/export password (NOT RECOMMENDED)\n");		BIO_printf (bio_err, "-password p set import/export password (NOT RECOMMENDED)\n");
	@@ -391,8 +414,7 @@ int MAIN(int argc, char **argv)
	p8 = EVP_PKEY2PKCS8 (key);		p8 = EVP_PKEY2PKCS8 (key);
	EVP_PKEY_free(key);		EVP_PKEY_free(key);
	if(keytype) PKCS8_add_keyusage(p8, keytype);		if(keytype) PKCS8_add_keyusage(p8, keytype);
	bag = PKCS12_MAKE_SHKEYBAG(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,		bag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8);
	cpass, -1, NULL, 0, iter, p8);
	PKCS8_PRIV_KEY_INFO_free(p8);		PKCS8_PRIV_KEY_INFO_free(p8);
	if (name) PKCS12_add_friendlyname (bag, name, -1);		if (name) PKCS12_add_friendlyname (bag, name, -1);
	PKCS12_add_localkeyid (bag, keyid, keyidlen);		PKCS12_add_localkeyid (bag, keyid, keyidlen);

apps/pkcs8.c

+11 −0

Original line number	Original line	Diff line number	Diff line
	@@ -99,6 +99,16 @@ int MAIN(int argc, char **argv)
	badarg = 1;		badarg = 1;
	}		}
	} else badarg = 1;		} else badarg = 1;
			} else if (!strcmp(*args,"-v1")) {
			if (args[1]) {
			args++;
			pbe_nid=OBJ_txt2nid(*args);
			if(pbe_nid == NID_undef) {
			BIO_printf(bio_err,
			"Unknown PBE algorithm %s\n", *args);
			badarg = 1;
			}
			} else badarg = 1;
	} else if (!strcmp(*args,"-inform")) {		} else if (!strcmp(*args,"-inform")) {
	if (args[1]) {		if (args[1]) {
	args++;		args++;
	@@ -139,6 +149,7 @@ int MAIN(int argc, char **argv)
	BIO_printf (bio_err, "-noiter use 1 as iteration count\n");		BIO_printf (bio_err, "-noiter use 1 as iteration count\n");
	BIO_printf (bio_err, "-nocrypt use or expect unencrypted private key\n");		BIO_printf (bio_err, "-nocrypt use or expect unencrypted private key\n");
	BIO_printf (bio_err, "-v2 alg use PKCS#5 v2.0 and cipher \"alg\"\n");		BIO_printf (bio_err, "-v2 alg use PKCS#5 v2.0 and cipher \"alg\"\n");
			BIO_printf (bio_err, "-v1 obj use PKCS#5 v1.5 and cipher \"alg\"\n");
	return (1);		return (1);
	}		}

crypto/asn1/Makefile.ssl

+7 −0

Original line number	Original line	Diff line number	Diff line
	@@ -223,6 +223,13 @@ a_meth.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
	a_meth.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h		a_meth.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
	a_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h		a_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
	a_meth.o: ../cryptlib.h		a_meth.o: ../cryptlib.h
			a_null.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
			a_null.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
			a_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
			a_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
			a_null.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
			a_null.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
			a_null.o: ../cryptlib.h
	a_object.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h		a_object.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
	a_object.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h		a_object.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
	a_object.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h		a_object.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h

crypto/objects/obj_dat.h

+31 −21

Original line number	Original line	Diff line number	Diff line
	@@ -62,7 +62,7 @@
	*/		*/

	#define NUM_NID 181		#define NUM_NID 181
	#define NUM_SN 128		#define NUM_SN 140
	#define NUM_LN 175		#define NUM_LN 175
	#define NUM_OBJ 152		#define NUM_OBJ 152

	@@ -233,10 +233,10 @@ static ASN1_OBJECT nid_objs[NUM_NID]={
	&(lvalues[47]),0},		&(lvalues[47]),0},
	{"RSA-MD5","md5WithRSAEncryption",NID_md5WithRSAEncryption,9,		{"RSA-MD5","md5WithRSAEncryption",NID_md5WithRSAEncryption,9,
	&(lvalues[56]),0},		&(lvalues[56]),0},
	{"pbeWithMD2AndDES-CBC","pbeWithMD2AndDES-CBC",		{"PBE-MD2-DES","pbeWithMD2AndDES-CBC",NID_pbeWithMD2AndDES_CBC,9,
	NID_pbeWithMD2AndDES_CBC,9,&(lvalues[65]),0},		&(lvalues[65]),0},
	{"pbeWithMD5AndDES-CBC","pbeWithMD5AndDES-CBC",		{"PBE-MD5-DES","pbeWithMD5AndDES-CBC",NID_pbeWithMD5AndDES_CBC,9,
	NID_pbeWithMD5AndDES_CBC,9,&(lvalues[74]),0},		&(lvalues[74]),0},
	{"X500","X500",NID_X500,1,&(lvalues[83]),0},		{"X500","X500",NID_X500,1,&(lvalues[83]),0},
	{"X509","X509",NID_X509,2,&(lvalues[84]),0},		{"X509","X509",NID_X509,2,&(lvalues[84]),0},
	{"CN","commonName",NID_commonName,3,&(lvalues[86]),0},		{"CN","commonName",NID_commonName,3,&(lvalues[86]),0},
	@@ -312,8 +312,8 @@ static ASN1_OBJECT nid_objs[NUM_NID]={
	&(lvalues[355]),0},		&(lvalues[355]),0},
	{"DSA-SHA","dsaWithSHA",NID_dsaWithSHA,5,&(lvalues[364]),0},		{"DSA-SHA","dsaWithSHA",NID_dsaWithSHA,5,&(lvalues[364]),0},
	{"DSA-old","dsaEncryption-old",NID_dsa_2,5,&(lvalues[369]),0},		{"DSA-old","dsaEncryption-old",NID_dsa_2,5,&(lvalues[369]),0},
	{"pbeWithSHA1AndRC2-CBC","pbeWithSHA1AndRC2-CBC",		{"PBE-SHA1-RC2-64","pbeWithSHA1AndRC2-CBC",NID_pbeWithSHA1AndRC2_CBC,
	NID_pbeWithSHA1AndRC2_CBC,9,&(lvalues[374]),0},		9,&(lvalues[374]),0},
	{"PBKDF2","PBKDF2",NID_id_pbkdf2,9,&(lvalues[383]),0},		{"PBKDF2","PBKDF2",NID_id_pbkdf2,9,&(lvalues[383]),0},
	{"DSA-SHA1-old","dsaWithSHA1-old",NID_dsaWithSHA1_2,5,&(lvalues[392]),0},		{"DSA-SHA1-old","dsaWithSHA1-old",NID_dsaWithSHA1_2,5,&(lvalues[392]),0},
	{"nsCertType","Netscape Cert Type",NID_netscape_cert_type,9,		{"nsCertType","Netscape Cert Type",NID_netscape_cert_type,9,
	@@ -417,19 +417,17 @@ static ASN1_OBJECT nid_objs[NUM_NID]={
	{"invalidityDate","Invalidity Date",NID_invalidity_date,3,		{"invalidityDate","Invalidity Date",NID_invalidity_date,3,
	&(lvalues[733]),0},		&(lvalues[733]),0},
	{"SXNetID","Strong Extranet ID",NID_sxnet,5,&(lvalues[736]),0},		{"SXNetID","Strong Extranet ID",NID_sxnet,5,&(lvalues[736]),0},
	{"pbeWithSHA1And128BitRC4","pbeWithSHA1And128BitRC4",		{"PBE-SHA1-RC4-128","pbeWithSHA1And128BitRC4",
	NID_pbe_WithSHA1And128BitRC4,10,&(lvalues[741]),0},		NID_pbe_WithSHA1And128BitRC4,10,&(lvalues[741]),0},
	{"pbeWithSHA1And40BitRC4","pbeWithSHA1And40BitRC4",		{"PBE-SHA1-RC4-40","pbeWithSHA1And40BitRC4",
	NID_pbe_WithSHA1And40BitRC4,10,&(lvalues[751]),0},		NID_pbe_WithSHA1And40BitRC4,10,&(lvalues[751]),0},
	{"pbeWithSHA1And3-KeyTripleDES-CBC",		{"PBE-SHA1-3DES","pbeWithSHA1And3-KeyTripleDES-CBC",
	"pbeWithSHA1And3-KeyTripleDES-CBC",
	NID_pbe_WithSHA1And3_Key_TripleDES_CBC,10,&(lvalues[761]),0},		NID_pbe_WithSHA1And3_Key_TripleDES_CBC,10,&(lvalues[761]),0},
	{"pbeWithSHA1And2-KeyTripleDES-CBC",		{"PBE-SHA1-2DES","pbeWithSHA1And2-KeyTripleDES-CBC",
	"pbeWithSHA1And2-KeyTripleDES-CBC",
	NID_pbe_WithSHA1And2_Key_TripleDES_CBC,10,&(lvalues[771]),0},		NID_pbe_WithSHA1And2_Key_TripleDES_CBC,10,&(lvalues[771]),0},
	{"pbeWithSHA1And128BitRC2-CBC","pbeWithSHA1And128BitRC2-CBC",		{"PBE-SHA1-RC2-128","pbeWithSHA1And128BitRC2-CBC",
	NID_pbe_WithSHA1And128BitRC2_CBC,10,&(lvalues[781]),0},		NID_pbe_WithSHA1And128BitRC2_CBC,10,&(lvalues[781]),0},
	{"pbeWithSHA1And40BitRC2-CBC","pbeWithSHA1And40BitRC2-CBC",		{"PBE-SHA1-RC2-40","pbeWithSHA1And40BitRC2-CBC",
	NID_pbe_WithSHA1And40BitRC2_CBC,10,&(lvalues[791]),0},		NID_pbe_WithSHA1And40BitRC2_CBC,10,&(lvalues[791]),0},
	{"keyBag","keyBag",NID_keyBag,11,&(lvalues[801]),0},		{"keyBag","keyBag",NID_keyBag,11,&(lvalues[801]),0},
	{"pkcs8ShroudedKeyBag","pkcs8ShroudedKeyBag",NID_pkcs8ShroudedKeyBag,		{"pkcs8ShroudedKeyBag","pkcs8ShroudedKeyBag",NID_pkcs8ShroudedKeyBag,
	@@ -455,12 +453,12 @@ static ASN1_OBJECT nid_objs[NUM_NID]={
	{"RC2-64-CBC","rc2-64-cbc",NID_rc2_64_cbc,0,NULL},		{"RC2-64-CBC","rc2-64-cbc",NID_rc2_64_cbc,0,NULL},
	{"SMIME-CAPS","S/MIME Capabilities",NID_SMIMECapabilities,9,		{"SMIME-CAPS","S/MIME Capabilities",NID_SMIMECapabilities,9,
	&(lvalues[957]),0},		&(lvalues[957]),0},
	{"pbeWithMD2AndRC2-CBC","pbeWithMD2AndRC2-CBC",		{"PBE-MD2-RC2-64","pbeWithMD2AndRC2-CBC",NID_pbeWithMD2AndRC2_CBC,9,
	NID_pbeWithMD2AndRC2_CBC,9,&(lvalues[966]),0},		&(lvalues[966]),0},
	{"pbeWithMD5AndRC2-CBC","pbeWithMD5AndRC2-CBC",		{"PBE-MD5-RC2-64","pbeWithMD5AndRC2-CBC",NID_pbeWithMD5AndRC2_CBC,9,
	NID_pbeWithMD5AndRC2_CBC,9,&(lvalues[975]),0},		&(lvalues[975]),0},
	{"pbeWithSHA1AndDES-CBC","pbeWithSHA1AndDES-CBC",		{"PBE-SHA1-DES","pbeWithSHA1AndDES-CBC",NID_pbeWithSHA1AndDES_CBC,9,
	NID_pbeWithSHA1AndDES_CBC,9,&(lvalues[984]),0},		&(lvalues[984]),0},
	{"msExtReq","Microsoft Extension Request",NID_ms_ext_req,10,		{"msExtReq","Microsoft Extension Request",NID_ms_ext_req,10,
	&(lvalues[993]),0},		&(lvalues[993]),0},
	{"extReq","Extension Request",NID_ext_req,9,&(lvalues[1003]),0},		{"extReq","Extension Request",NID_ext_req,9,&(lvalues[1003]),0},
	@@ -522,6 +520,18 @@ static ASN1_OBJECT *sn_objs[NUM_SN]={
	&(nid_objs[17]),/* "O" */		&(nid_objs[17]),/* "O" */
	&(nid_objs[178]),/* "OCSP" */		&(nid_objs[178]),/* "OCSP" */
	&(nid_objs[18]),/* "OU" */		&(nid_objs[18]),/* "OU" */
			&(nid_objs[ 9]),/* "PBE-MD2-DES" */
			&(nid_objs[168]),/* "PBE-MD2-RC2-64" */
			&(nid_objs[10]),/* "PBE-MD5-DES" */
			&(nid_objs[169]),/* "PBE-MD5-RC2-64" */
			&(nid_objs[147]),/* "PBE-SHA1-2DES" */
			&(nid_objs[146]),/* "PBE-SHA1-3DES" */
			&(nid_objs[170]),/* "PBE-SHA1-DES" */
			&(nid_objs[148]),/* "PBE-SHA1-RC2-128" */
			&(nid_objs[149]),/* "PBE-SHA1-RC2-40" */
			&(nid_objs[68]),/* "PBE-SHA1-RC2-64" */
			&(nid_objs[144]),/* "PBE-SHA1-RC4-128" */
			&(nid_objs[145]),/* "PBE-SHA1-RC4-40" */
	&(nid_objs[127]),/* "PKIX" */		&(nid_objs[127]),/* "PKIX" */
	&(nid_objs[98]),/* "RC2-40-CBC" */		&(nid_objs[98]),/* "RC2-40-CBC" */
	&(nid_objs[166]),/* "RC2-64-CBC" */		&(nid_objs[166]),/* "RC2-64-CBC" */